Analysis

  • max time kernel
    93s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2024, 14:14

General

  • Target

    3510c548c14978de64c4d604dcef70f2_JaffaCakes118.exe

  • Size

    322KB

  • MD5

    3510c548c14978de64c4d604dcef70f2

  • SHA1

    2b39cd0c45fee342bf2f27f280f3fe773da00f3d

  • SHA256

    4d81308b268d6f1142503f8039b33f7bc79a0f16c048deb680c4cf8dd5be2b30

  • SHA512

    d403a951a233cc41262b51f168e0cc9351ac05896f501b911b55c616a2e2a3c53dc1489822e19a952e990dff7bcc5c1a5a830760d535379489f6522a43858391

  • SSDEEP

    6144:oAaDO4opVYS+F/FJSorYB+fEap95NWtEu5Yr6iGuyS7XfZ00mCO7cj:ADwzQFNpuUrRczSjhPF

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3510c548c14978de64c4d604dcef70f2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3510c548c14978de64c4d604dcef70f2_JaffaCakes118.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:3116

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3116-0-0x0000000000F40000-0x0000000000F87000-memory.dmp

          Filesize

          284KB

        • memory/3116-1-0x0000000000D90000-0x0000000000DD3000-memory.dmp

          Filesize

          268KB

        • memory/3116-2-0x0000000000F40000-0x0000000000F87000-memory.dmp

          Filesize

          284KB

        • memory/3116-3-0x0000000000F40000-0x0000000000F87000-memory.dmp

          Filesize

          284KB

        • memory/3116-5-0x0000000000F40000-0x0000000000F87000-memory.dmp

          Filesize

          284KB

        • memory/3116-4-0x0000000000F41000-0x0000000000F5C000-memory.dmp

          Filesize

          108KB

        • memory/3116-8-0x0000000000D90000-0x0000000000DD3000-memory.dmp

          Filesize

          268KB

        • memory/3116-7-0x0000000000D90000-0x0000000000DD3000-memory.dmp

          Filesize

          268KB

        • memory/3116-6-0x0000000000E20000-0x0000000000E21000-memory.dmp

          Filesize

          4KB

        • memory/3116-10-0x0000000000F40000-0x0000000000F87000-memory.dmp

          Filesize

          284KB